Even if that Siemens motor controller was common, its use case in Iran was rather specific, and chances are the payload was pretty specific to exact firmware levels. From Wiki:

While the worm is promiscuous, it makes itself inert if Siemens software is not found on infected computers, and contains safeguards to prevent each infected computer from spreading the worm to more than three others, and to erase itself on 24 June 2012.

Had it been given a shorter life span than two years, chances are it would never have been discovered.

The real risk here is that others have climbed on board this train and are using essentially the same engine for other purposes.